Linux kernel BPF: sleepable LSM cgroup programs sleep in an RCU read-side critical section

Impact

The cgroup LSM shim runs under rcu_read_lock_dont_migrate(), but the verifier accepted BPF_LSM_CGROUP programs marked BPF_F_SLEEPABLE. Such a program calling a sleeping helper (the report uses bpf_get_dentry_xattr(), which takes a rwsem inside ext4_xattr_get()) sleeps in invalid context, producing a "sleeping function called from invalid context" splat on a hot security hook such as file_open. On nodes that run cgroup-scoped LSM BPF for tenant isolation or policy, this is a stability and correctness problem in the enforcement path rather than a bypass of a specific check. libbpf never exposed a sleepable section for lsm_cgroup, so only a loader calling bpf(2) directly reaches it.

Who can reach it

Local and privileged: the attacker or operator must be able to load BPF programs (CAP_BPF/CAP_SYS_ADMIN, in the init or an appropriately delegated namespace) and must bypass libbpf to set the sleepable flag on an lsm_cgroup program. Not reachable by an unprivileged tenant pod under a default policy.

What to do

Update to a stable kernel where the verifier rejects sleepable BPF_LSM_CGROUP programs at load time (backported to multiple stable branches; see the linked commits) and reboot the node after draining. In the meantime, restricting who can call bpf(2) - the usual CAP_BPF hygiene on shared nodes - removes the path, since no supported libbpf-built program triggers it.

References

Related entries

• Linux kernel BPF: stale rbtree node linkage after bpf_rb_root_free allows erase on a freed rootCVE-2026-74344 · Linux kernel BPF (bpf_rb_root_free, rbtree node owner linkage)High
• Linux kernel BPF: BPF_PROG_QUERY writes the revision field past a short bpf_attr from userspaceCVE-2026-74371 · Linux kernel BPF BPF_PROG_QUERY (cgroup query revision write-back)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDCVE-2026-74446 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-74447 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel THP split: use-after-free on the inode when memory-failure splits a shmem huge pageCVE-2026-74482 · Linux kernel mm/huge_memory (__folio_split i_mmap_rwsem release order)High
• Linux kernel hugetlbfs: list corruption in reservation top-up can link a kernel-stack address into MM stateCVE-2026-74518 · Linux kernel hugetlbfs reservation map (allocate_file_region_entries)High